Horde XSS Filter Cross Site Scripting Vulnerability

Bugtraq ID:	33367
Class:	Input Validation Error
CVE:	CVE-2008-5917
Remote:	Yes
Local:	No
Published:	Jan 20 2009 12:00AM
Updated:	Apr 13 2015 09:53PM
Credit:	Reported by the vendor
Vulnerable:	Horde Project Horde 3.3 Horde Project Horde 3.2.2 Horde Project Horde 3.2.1 Horde Project Horde 3.2 Horde Project Groupware Webmail Edition 1.1.3 Horde Project Groupware Webmail Edition 1.2 Horde Project Groupware 1.1.3 Horde Project Groupware 1.2 Gentoo Linux Debian Linux 4.0 sparc Debian Linux 4.0 s/390 Debian Linux 4.0 powerpc Debian Linux 4.0 mipsel Debian Linux 4.0 mips Debian Linux 4.0 m68k Debian Linux 4.0 ia-64 Debian Linux 4.0 ia-32 Debian Linux 4.0 hppa Debian Linux 4.0 armel Debian Linux 4.0 arm Debian Linux 4.0 amd64 Debian Linux 4.0 alpha Debian Linux 4.0
Not Vulnerable:	Horde Project Horde 3.3.1 Horde Project Horde 3.2.3 Horde Project Groupware Webmail Edition 1.2.1 Horde Project Groupware Webmail Edition 1.1.4 Horde Project Groupware 1.2.1 Horde Project Groupware 1.1.5

Horde XSS Filter Cross Site Scripting Vulnerability

Horde is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

Note that this issue also affects Turba on Horde IMP.

Versions prior to Horde 3.2.3 and 3.3.1 are vulnerable.

Horde XSS Filter Cross Site Scripting Vulnerability

Attackers can exploit this issue by enticing an unsuspecting user to follow a malicious URI.

Horde XSS Filter Cross Site Scripting Vulnerability

Solution:
Updates are available. Please see the references for more information.


Debian Linux 4.0 amd64

• Debian horde3_3.1.3-4etch5_all.deb
  http://security.debian.org/pool/updates/main/h/horde3/horde3_3.1.3-4et ch5_all.deb

Debian Linux 4.0 ia-32

• Debian horde3_3.1.3-4etch5_all.deb
  http://security.debian.org/pool/updates/main/h/horde3/horde3_3.1.3-4et ch5_all.deb

Debian Linux 4.0 arm

• Debian horde3_3.1.3-4etch5_all.deb
  http://security.debian.org/pool/updates/main/h/horde3/horde3_3.1.3-4et ch5_all.deb

Debian Linux 4.0 hppa

• Debian horde3_3.1.3-4etch5_all.deb
  http://security.debian.org/pool/updates/main/h/horde3/horde3_3.1.3-4et ch5_all.deb

Debian Linux 4.0 sparc

• Debian horde3_3.1.3-4etch5_all.deb
  http://security.debian.org/pool/updates/main/h/horde3/horde3_3.1.3-4et ch5_all.deb

Debian Linux 4.0 s/390

• Debian horde3_3.1.3-4etch5_all.deb
  http://security.debian.org/pool/updates/main/h/horde3/horde3_3.1.3-4et ch5_all.deb

Horde Project Groupware 1.2

• Horde horde-groupware-1.2.1.tar.gz
  http://ftp.horde.org/pub/horde-groupware/horde-groupware-1.2.1.tar.gz

Debian Linux 4.0 powerpc

• Debian horde3_3.1.3-4etch5_all.deb
  http://security.debian.org/pool/updates/main/h/horde3/horde3_3.1.3-4et ch5_all.deb

Debian Linux 4.0 alpha

• Debian horde3_3.1.3-4etch5_all.deb
  http://security.debian.org/pool/updates/main/h/horde3/horde3_3.1.3-4et ch5_all.deb

Debian Linux 4.0 armel

• Debian horde3_3.1.3-4etch5_all.deb
  http://security.debian.org/pool/updates/main/h/horde3/horde3_3.1.3-4et ch5_all.deb

Debian Linux 4.0 m68k

• Debian horde3_3.1.3-4etch5_all.deb
  http://security.debian.org/pool/updates/main/h/horde3/horde3_3.1.3-4et ch5_all.deb

Debian Linux 4.0

• Debian horde3_3.1.3-4etch5_all.deb
  http://security.debian.org/pool/updates/main/h/horde3/horde3_3.1.3-4et ch5_all.deb

Debian Linux 4.0 mipsel

• Debian horde3_3.1.3-4etch5_all.deb
  http://security.debian.org/pool/updates/main/h/horde3/horde3_3.1.3-4et ch5_all.deb

Horde Project Groupware Webmail Edition 1.2

• Horde horde-webmail-1.2.1.tar.gz
  http://ftp.horde.org/pub/horde-webmail/horde-webmail-1.2.1.tar.gz

Horde Project Horde 3.2

• Horde patch-horde-3.2.2-3.2.3.gz
  ftp://ftp.horde.org/pub/horde/patches/patch-horde-3.2.2-3.2.3.gz

Debian Linux 4.0 ia-64

• Debian horde3_3.1.3-4etch5_all.deb
  http://security.debian.org/pool/updates/main/h/horde3/horde3_3.1.3-4et ch5_all.deb

Debian Linux 4.0 mips

• Debian horde3_3.1.3-4etch5_all.deb
  http://security.debian.org/pool/updates/main/h/horde3/horde3_3.1.3-4et ch5_all.deb

Horde Project Groupware Webmail Edition 1.1.3

• Horde horde-webmail-1.1.4.tar.gz
  http://ftp.horde.org/pub/horde-webmail/horde-webmail-1.1.4.tar.gz

Horde Project Groupware 1.1.3

• Horde horde-groupware-1.1.4.tar.gz
  http://ftp.horde.org/pub/horde-groupware/horde-groupware-1.1.4.tar.gz

Horde Project Horde 3.2.1

• Horde patch-horde-3.2.2-3.2.3.gz
  ftp://ftp.horde.org/pub/horde/patches/patch-horde-3.2.2-3.2.3.gz

Horde Project Horde 3.2.2

• Horde patch-horde-3.2.2-3.2.3.gz
  ftp://ftp.horde.org/pub/horde/patches/patch-horde-3.2.2-3.2.3.gz

Horde Project Horde 3.3

• Horde horde-3.3.1.tar.gz
  ftp://ftp.horde.org/pub/horde/horde-3.3.1.tar.gz

Horde XSS Filter Cross Site Scripting Vulnerability

References:

• [announce] Horde 3.2.3 (final) (Horde)
  
• [announce] Horde 3.3.1 (final) (Horde)
  
• Pandora Homepage (Pandora FMS Team)
  
• [announce] Horde Groupware 1.1.4 (final) (Horde Project)
  
• [announce] Horde Groupware 1.2.1 (final) (Horde Project)
  
• [announce] Horde Groupware Webmail Edition 1.1.4 (final) (Horde Project)
  
• [announce] Horde Groupware Webmail Edition 1.2.1 (final) (Horde Project)